CoreCVE
Back

HIGH

Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page

Published Sep 29, 2026

Description

Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (3)

Change history (14)
  1. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 8.8 to 7.5

  2. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 7.5 to 8.8

  3. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 8.8 to 7.5

  4. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 7.5 to 8.8

  5. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 8.8 to 7.5

  6. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 7.5 to 8.8

  7. CISA ADP

    • CVSS vector

      changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H to CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

    • CVSS score

      changed from 8.8 to 7.5

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Chrome
Published Sep 29, 2026
Updated Sep 30, 2026
Reserved Sep 22, 2026
Link CVE-2026-95280

CISA Vulnrichment

Updated Sep 29, 2026

NVD

Status Undergoing Analysis
Modified Sep 29, 2026
Link CVE-2026-95280

Red Hat

No data

ENISA EUVD

Assigner Chrome
Published Sep 29, 2026
Updated Sep 30, 2026
Link EUVD-2026-89242

GitHub

No data